feat(user): block login when .. blocked

app/models/user.rb

@@ -235,7 +235,7 @@ def merge(old_user)
       old_user.targeted_user_links.update_all(user_id: id)
 
       # Move or merge old user's roles to the user
-      [
+      [ 
         [old_user.instructeur, instructeur],
         [old_user.expert, expert],
         [old_user.administrateur, administrateur]
@@ -267,6 +267,10 @@ def send_devise_notification(notification, *args)
     devise_mailer.send(notification, self, *args).deliver_later
   end
 
+  def active_for_authentication?
+    super && blocked_at.nil?
+  end
+
   private
 
   def does_not_merge_on_self

spec/system/users/sign_up_spec.rb

@@ -142,4 +142,17 @@
       expect(page).to have_current_path new_user_session_path
     end
   end
+
+  context 'when the user already has a confirmed account but is blocked' do
+    before do
+      create(:user, email: user_email, password: user_password, blocked_at: Time.current)
+    end
+
+    scenario 'they cannot signed in' do
+      visit new_user_session_path
+      sign_in_with user_email, user_password
+
+      expect(page).to have_current_path new_user_session_path
+    end
+  end
 end